LeakedSource Shut Down by DOJ

Last week a breach notification site named LeakedSource was allegedly shut down by US law enforcement and much of their equipment confiscated. While the Department of Justice is refusing to comment or confirm, the social media accounts of the operators have been suspended and the site itself is offline. At the current time, the reasons why they may have been targeted by law enforcement are unknown, although it’s possible to hazard some guesses as to why.

LeakedSource frequently had the data from the very latest breaches, despite the fact that many of those breaches were simply not publicly available yet and in some cases had happened mere days prior to them obtaining it. This led to speculation in security circles that LeakedSource was buying data or had an inappropriately close relationship with the perpetrators. To further complicate the issue, LeakedSource seemed like they were a tool more tailored for black hat types than they were for companies and security researchers: anyone willing to pay the subscription fee could view credentials (often including cleartext passwords) for practically any account in their database. Indeed it doesn’t take much searching in hacking forums to find that this was a much loved tool for many in that community. This raised plenty of red flags in the security world. The fact that LeakedSource’s operators, organization, and infrastructure were anonymous and shrouded in mystery didn’t provide much reassurance for companies tempted to use them to help secure their users.

At PasswordPing, we take a different approach – one that ensures our service cannot be used for nefarious purposes. First, we NEVER return raw passwords or credential data. Period. We never return email addresses. We never return passwords. The only thing our service will tell you is whether a submitted password or set of credentials has been publicly exposed. Additionally, we never buy data. Ethically we believe it would be wrong to subsidize the very problem we are purporting to solve. Thus, all of our data is harvested from the public Internet. PasswordPing is purpose built for companies to protect their users and employees from credential exposures – not to aid cyber criminals. We are experienced security industry professionals and stake our reputations on the security and trustworthiness of our business.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater.

Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More Information

This site is for EDUCATIONAL PURPOSES ONLY. Your password will be sent securely to the PasswordPing servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.

What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.